Critical LMCache Vulnerability Allows Unauthenticated Remote Code Execution
ID: 8f67b694-c45e-53df-84ac-f754a0b620a2
STIX ID: report--8f67b694-c45e-53df-84ac-f754a0b620a2
Feed Name: ThreatCluster
Threat Score
A critical unauthenticated remote code execution vulnerability (CVE-2026-105192, CVSS 9.8) was disclosed in LMCache (versions 0.3.9–0.5.5). The flaw can be triggered by sending a crafted message to an unauthenticated ZeroMQ socket on port 5555, allows arbitrary code execution with the LMCache process privileges (notably running as root in official containers), and as of the report no patch is available—JFrog recommends restricting network access to mitigate risk.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.